diff --git a/Cargo.lock b/Cargo.lock
index 0d42c03..ac0aaf2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1879,9 +1879,9 @@ checksum = "20870f649af7073d53e38067b2a84312175d56ea15217e1b15bc83506ec50afb"
 
 [[package]]
 name = "libc"
-version = "0.2.191"
+version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libloading"
diff --git a/Cargo.toml b/Cargo.toml
index ae49ac3..add1fed 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -43,7 +43,11 @@ iroh = { version = "1.4.0", features = ["unstable-custom-transports"] }
 noq-proto = "1.4.0"
 n0-watcher = "1.0.1"
 log = "0.4"
-libc = "0.2"
+# Capped below 0.2.190, which limits `in6_ifreq` to macOS: netdev (via iroh's
+# netwatch) still uses it on every Apple target, so the iOS slice of the
+# xcframework fails to compile against a newer libc. Lift the cap once netdev
+# ships shellrow/netdev#192 (defines the struct locally) and iroh picks it up.
+libc = ">=0.2, <0.2.190"
 rand = "0.10"
 # Custom-relay `/healthz` checks (see `transport::paths`). `rustls-no-provider`
 # matches the exact reqwest feature iroh already enables, so this adds no new TLS